SUSPICIOUS — 11b3fa21c17510300571f67a9285fb6a9b48fe3f628b8affbb932d55db98400e

SUSPICIOUS — 11b3fa21c17510300571f67a9285fb6a9b48fe3f628b8affbb932d55db98400e is a html sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 11b3fa21c17510300571f67a9285fb6a9b48fe3f628b8affbb932d55db98400e
• SHA-1: e642cc69118ec3e9019aa19ad465296e72a3c4f1
• MD5: e068900c285852efba9c31c43ff8da05
• ssdeep: 3072:28Oh/SSodbnckaYJNQMcZfgfdCqhC3+fE3HeHdHfNT2ZDHerNDkU3E:kh/SSokTwy
• TLSH: T11D3E192B6F943E8904944573A0582AE861D68B97DD3342E9E162EFC9CD2CC748D0CF67
• Submitted as: 11b3fa21c17510300571f67a9285fb6a9b48fe3f628b8affbb932d55db98400e
• File type: html · Size: 136801 bytes
• Verdict: suspicious (54/100)

Detections (2 of 53 engines)

• Microsoft Defender: TrojanClicker:JS/Faceliker.M
• Kaspersky (KVRT): HEUR:Trojan.Script.Generic

Why this verdict

The suspicious score of 54/100 is the fusion of 2 weighted signals:

• Obfuscated javascript script: dynamic-exec (layers: concat) (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• Embedded network infrastructure: https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css, http://phimhddd.blogspot.com/favicon.ico, http://phimhddd.blogspot.com/search/label/m%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C2%A1%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%BB%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%B9%20-%20ch%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C6%92%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%A2u%20%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C6%92%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%E2%80%9Au - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://schema.org/Blog
• http://www.w3.org/1999/xhtml
• http://www.google.com/2005/gml/b
• http://www.google.com/2005/gml/data
• http://www.google.com/2005/gml/expr
• https://www.blogger.com/static/v1/widgets/1394523530-widget_css_bundle.css
• http://phimhddd.blogspot.com/favicon.ico
• http://phimhddd.blogspot.com/search/label/m%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C2%A1%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%BB%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%B9%20-%20ch%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C6%92%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%C2%A2u%20%C3%83%C6%92%C3%82%C6%92%C3%83%E2%80%9A%C3%82%C6%92%C3%83%C6%92%C3%82%E2%80%9A%C3%83%E2%80%9A%C3%82%E2%80%9Au
• http://phimhddd.blogspot.com/feeds/posts/default
• http://phimhddd.blogspot.com/feeds/posts/default?alt=rss
• https://www.blogger.com/feeds/983411471944363842/posts/default
• https://www.blogger.com/profile/16083800064879812428
• http://cliphot.me/anhtuank3y/msexy-ung-dung-xem-video-3
• http://4.bp.blogspot.com/-15aCXWHUUoI/UWVJ-IJvvkI/AAAAAAAAAyY/7eQILI_I4VI/s1600/bg.jpg
• http://3.bp.blogspot.com/-tQxshKVrEiA/UKYWBCJuWTI/AAAAAAAAASg/KkVht2Z3sSA/s1600/sprite2.png
• http://1.bp.blogspot.com/-gA9ZfIdus80/UKYVziljQ6I/AAAAAAAAASY/7qRP4nbrMMg/s1600/sprite.png
• http://3.bp.blogspot.com/-IMVKlRJsPPU/UMsVKwO7MYI/AAAAAAAABzI/IXvG053DEko/s1600/loading1.gif
• http://3.bp.blogspot.com/--j4lVKfbFFQ/UdKoN6wcDiI/AAAAAAAAWOw/UL5xCQqSHq4/s156/repeat-x.png
• http://3.bp.blogspot.com/-jgJfIQRp-rY/UdKmiJAqYdI/AAAAAAAAWOg/DRp7Tx_ir7M/s1600/no-repeat.png
• http://phimhay4u.com/images/bgcontent.jpg
• http://phimhay4u.com/images/bglist.png
• http://2.bp.blogspot.com/-BR742T3brc4/UKxL4v9kA-I/AAAAAAAAFiA/wHRSW_I7EU4/s1600/nav.png
• http://3.bp.blogspot.com/-wbNCtroyALQ/UKxKDZGQeFI/AAAAAAAAFh4/wrl1GYrBZa4/s1600/home.png
• http://4.bp.blogspot.com/-BYrnLPzzWdQ/UKkw-epUFuI/AAAAAAAAFeo/DkQ0-EI9Spk/s1600/arrow_menu.png
• http://2.bp.blogspot.com/-v1JhImsDL7Q/UKxL5ZLycOI/AAAAAAAAFiE/2tc3Wht0T-o/s1600/nav_hover.png

Embedded domains

• schema.org
• www.w3.org
• www.google.com
• www.blogger.com
• phimhddd.blogspot.com
• up.link
• cliphot.me
• www.phimsock.com
• gmail.com
• www.luubuttuoixanh.com
• 4.bp.blogspot.com
• 3.bp.blogspot.com
• 1.bp.blogspot.com
• st.top
• phimhay4u.com
• 2.bp.blogspot.com
• apis.google.com
• keyrom.googlecode.com
• nguyenhuytap.googlecode.com
• phimshock-share123vn.blogspot.com
• a.link
• www.google-analytics.com
• blogspot.com
• connect.facebook.net
• data-vocabulary.org

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report